Add support for v2 containerd metrics in the shim, v2 metrics are only used when runsc is run with --system-cgroup=true.
Containerd requires v2 metrics when the host is run with CGroupsV2.
This issue was noticed when attempting to gather metrics on AL2023 which defaults to CGroupsV2.
Fixes: #11472
Signed-off-by: Champ-Goblem <cameron@northflank.com>
When a pages file is provided to `runsc restore`, reads from that file are
asynchronous (via statefile.AsyncReader) in order to maximize throughput.
However, all such reads must complete before Kernel.LoadFrom() returns, so
applications cannot execute before MemoryFile loading is complete. The main
objective of this CL is to allow reads to continue after Kernel.LoadFrom()
returns, allowing applications to execute while MemoryFile loading is still in
progress. This behavior is user-visible: it affects whether deleting the pages
file frees disk space immediately on POSIX filesystems, may affect whether
deletion is possible on non-POSIX filesystems, and prevents unmounting
regardless. Thus it is flag-guarded as `runsc restore --background`.
MemoryFile ranges that have yet to be loaded, but that are being waited-for by
applications, should be prioritized over ranges for which no application is
waiting. This requires that application requests for data (calls to
MemoryFile.(memmap.File).DataFD/MapInternal()) are able to determine which
ranges have not yet been loaded, request reads for such ranges with elevated
priority, and wait for only those reads to be completed; none of these are
supported by the existing statefile.AsyncReader.
Thus:
- Add //pkg/sentry/pgalloc/aio, which provides an async I/O API that is
designed to be easily implementable using a goroutine pool, Linux native AIO,
or io_uring, though only includes a goroutine pool implementation. (io_uring
is widely disabled due to security vulnerabilities. In my testing, Linux
native AIO is slower than the goroutine pool, but this may change with lower
GOMAXPROCS which needs further testing.)
- Move I/O scheduling into pgalloc: introduce an async page loader goroutine
that is started by MemoryFile.LoadFrom() when async page loading is requested
(implicitly, via the existence of a pages file), which is responsible for
driving submission of read requests and handling their completions.
PiperOrigin-RevId: 679321884
runsc start does not attached to the started container. runsc restore OTOH
attaches to the container being restored by default and waits for the container
to exit.
So when the shim converts start -> restore, retain the detach behavior.
Fixes 210e3f6ff3 ("Add restore support to runsc shim.")
PiperOrigin-RevId: 665056022
This allows the shim to be extended by intercepting calls to the
shim and deciding which one to forward to the runsc shim, and which
to handle in the interception shim.
PiperOrigin-RevId: 645421325
Starting with Go 1.21, build tags select the language version. We currently
have several `go:build go1.1` tags, which were intended to act as "true" tags.
But that will break with 1.21. So replace them with "!false".
Fixes#9568.
PiperOrigin-RevId: 576020779
Earlier, NewPodMountHints() was modifying the mount hints based on the
lifecycle. This change moves that annotation modification work to runsc shim.
It is more consistent for the shim to do all OCI spec modification work. Also
added more documentation about how EmptyDir is optimized in runsc.
This also allows us to delete the lifecycle mount annotation as it is no longer
used anywhere else.
PiperOrigin-RevId: 574600949
This change lands a performance optimization for EmptyDir volumes in gVisor.
Before this change, EmptyDir volumes were optimized as follows:
- If the EmptyDir had memory medium, then EmptyDir mounts in the containers
were converted into a shared tmpfs mount in the sentry.
- If the EmptyDir had default medium (was disk backed), then:
- If only one container in a pod was using this EmptyDir, then the EmptyDir
mount for that container was converted into an overlay mount, which had a
gofer lower layer and a tmpfs upper layer (with a file backend). The tmpfs
was backed by a file from the host EmptyDir mount itself. Such a file
backend was essential for size limit enforcement to work correctly.
- If multiple containers were using such an EmptyDir, then we can't optimize
it with such a "self-backed overlay", because it necessitates a "shared
gofer", which is not supported yet. So we fell back to slow gofer mounts.
However, the lower gofer layer is useless, because upon pod creation, the
EmptyDir is completely empty. Instead we can use a tmpfs with a file-backend.
This is what this change does. As a consequence, we can now optimize all
configurations of disk-backed EmptyDir volumes.
PiperOrigin-RevId: 574564462
This change adds a new mount annotation:
dev.gvisor.spec.mount.{volumeName}.lifecycle: shared | pod | container
For now runsc shim will be setting this annotation for all EmptyDir volumes.
Runsc looks at this annotation can adds a self-backed overlay on top of
EmptyDir volumes that have type=bind and share=container.
runsc gives precedence to mount annotations over --overlay2 configuration.
Added a container test for this feature.
This change also updates MountHint.fileAccessType() to be more generic using
all the available information about a mount.
PiperOrigin-RevId: 530746837
This change groups the following refactor work:
* Use volumeKeyPrefix consistently in shim/utils/volumes.go.
* Export boot.PodMountHints and boot.MountHint.
* Rename MountHint.isSupported() to isShared() to make it more accurate.
* Plumb MountHint more consistently throughout containerMounter methods. We do
this by calling c.hints.findMount() once and caching the result in a new
abstraction called `mountInfo` (earlier weirdly named mountAndFD). This also
helps in avoiding duplicate calls to c.hints.findMount() for the same volume.
This change does not impact behavior. This is in preparation for a following
change that adds overlay on top of disk-backed EmptyDir volumes. The intent is
to reduce clutter from the more important change for ease of review.
PiperOrigin-RevId: 529009982
Making the panic log directory be inside of the normal user-log directory makes
it possible to simply reuse the same spec annotation.
PiperOrigin-RevId: 466785655
gVisor bot
Champ-Goblem
Jing ChenandgVisor bot
Lucas ManningandgVisor bot
Koichi Shiraishi
Jamie LiuandgVisor bot
Ayush RanjanandgVisor bot
Shambhavi SrivastavaandgVisor bot
guangwuandGitHub
Adin ScannellandgVisor bot
Konstantin BogomolovandgVisor bot
Zach KoopmansandgVisor bot
Kevin KrakauerandgVisor bot